io_ring_submit() finalises with 1. io_commit_sqring(), which releases sqes to the userspace 2. Then calls to io_queue_link_head(), accessing released head's sqe Reorder them.
Unified · Split
| @@ -2795,13 +2795,14 @@ out: · 2794 unmodified lines | ||
| 2795 | 2795 | submit++; |
| 2796 | 2796 | io_submit_sqe(ctx, &s, statep, &link); |
| 2797 | 2797 | } |
| 2798 | − io_commit_sqring(ctx); | |
| 2799 | 2798 | |
| 2800 | 2799 | if (link) |
| 2801 | 2800 | io_queue_link_head(ctx, link, &link->submit, shadow_req); |
| 2802 | 2801 | if (statep) |
| 2803 | 2802 | io_submit_state_end(statep); |
| 2804 | 2803 | |
| 2804 | + io_commit_sqring(ctx); | |
| 2805 | + | |
| 2805 | 2806 | return submit; |
| 2806 | 2807 | } |
| 2807 | 2808 | |